AI Password-Cracking Capabilities Exceed Traditional Security Detection
Kaspersky analysis of 231 million leaked passwords (2023-2026) shows that 68% can be cracked within 24 hours and AI algorithms crack even 15-character passwords in under a minute. Traditional password complexity rules and security detection methods are reportedly insufficient to prevent AI-driven password attacks.
What happened
Kaspersky analysed 231 million unique passwords that leaked between 2023 and 2026 and found that 68.2% can be cracked within 24 hours, with 60.2% cracked in one hour.
AI algorithms can crack passwords of 15 characters or longer, with more than 20% breached in under one minute. The majority of compromised passwords follow predictable patterns: 53% end with a number, 17% start with a number, and approximately 12% contain numeric sequences suggesting dates.
Reported impact
Current password security practices and traditional detection methods are insufficient against AI-powered attacks, even when following established complexity requirements with capital letters, numbers and symbols.
The research indicates that even longer passwords no longer provide adequate protection against AI-based cracking techniques.
Index analysis
The analysis reveals that users employ predictable character placement patterns, making passwords vulnerable to brute force and AI-based attacks despite meeting standard complexity requirements.
Popular terms and internet trends, including the word 'Skibidi' which saw a 36-fold increase in use, are being widely incorporated into passwords, reducing their security.
Governance controls
Traditional security authentication systems rely on static models to identify exceptions and anomalies, which are insufficient to detect AI-driven attack patterns or defend against attacks leveraging side-channel methods.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.